| Status | Autorun name | Command | Description |
| N | EgisUpdate | EgisUpdate.exe | Software updater for Biometrics Solutions and Data Security products from EgisTec Inc |
| U | EGTSOFT System Locker | slocker.exe | Active System Locker by Sowsoft, LLC - "a handy utility that allows you to protect your personal computer from unauthorized access". Originally released as "EGTSOFT System Locker" by EGTSOFT |
| Y | egui | egui.exe | User interface for ESET NOD32 Antivirus and Smart Security |
| X | ehSched | ehSched.exe | Added by the SDBOT-DHF WORM! |
| U | ehTray | ehtray.exe | Media Center Tray Applet - part of Windows Media Center on XP MCE, Vista and Windows 7 (where it doesn't run as a startup). Allows Windows Media Center to be started by pressing the green button on a remote control and also displays System Tray notifications, such as recording status (successful or non-successful), EPG download notification, etc |
| U | ehTray.exe | ehTray.exe | Media Center Tray Applet - part of Windows Media Center on XP MCE, Vista and Windows 7 (where it doesn't run as a startup). Allows Windows Media Center to be started by pressing the green button on a remote control and also displays System Tray notifications, such as recording status (successful or non-successful), EPG download notification, etc |
| X | ei10.exe | ei10.exe | Added by the AGOBOT-NK WORM! |
| U | Eicon NetworksLAN_DAEMON | watch.exe | Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually |
| U | Eicon TechnologyLAN_DAEMON | watch.exe | Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually |
| Y | eISS_licreg | licreg.exe | Silently runs the product licensing and registration utility for older versions of both stand-alone security tools and suites from CA in the background on the first boot after installation. Also available via Start → All Programs where it displays the current licensing information |
| X | eixfi | china.bat | Added by the WCUP.A WORM! |
| X | eKerberos | eKerberos.exe | eKerberos rogue security software - not recommended |
| U | EKIJ5000StatusMonitor | EKIJ5000MUI.exe | Status monitor for Kodak's range of All-In-One printers - supports the scan button on the printer and launches the capture software when this is pressed and monitors printer status, ink levels, etc |
| U | ELBERT_S2P | Scan2pc.exe | Scan to PC application for the scanning function of the Samsung SCX-5x30 Series multifunction printers |
| U | ELBERTRicoh_S2P | Scan2pc.exe | Scan to PC application for the scanning function of the Ricoh MFP Type 104 multifunction printer |
| U | Elbycheck | ElbyCheck.exe | From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it |
| U | Electron Microscope | EMIII.exe | Electron Microscope or EM - is a program used to track Stanford's distributed computing program client called Folding at Home, FAH. It will monitor up to 50 clients and give you the details about each client's progress as the FAH client runs. EM will also show you what each change in the protein looks like as the process continues |
| U | EleFunAnimatedWallpaper | Alpine Lake.exe | Alpine Lake animated wallpaper from |
| U | EleFunAnimatedWallpaper | Amazing Waterfall.exe | Amazing Waterfall animated wallpaper from |
| U | EleFunAnimatedWallpaper | Autumn Sunset.exe | Autumn Sunset animated wallpaper from |
| U | EleFunAnimatedWallpaper | Dragon-Fly.exe | Dragon-Fly animated wallpaper from |
| U | EleFunAnimatedWallpaper | Fireplace.exe | Fireplace animated wallpaper from |
| U | EleFunAnimatedWallpaper | Jungle Waterfall.exe | Jungle Waterfall animated wallpaper from |
| U | EleFunAnimatedWallpaper | Midnight Fire.exe | Midnight Fire animated wallpaper from |
| U | EleFunAnimatedWallpaper | Mystery Forest.exe | Mystery Forest animated wallpaper from |
| U | EleFunAnimatedWallpaper | Silent Lagoon.exe | Silent Lagoon animated wallpaper from |
| U | EleFunAnimatedWallpaper | Three Windmills.exe | Three Windmills animated wallpaper from |
| U | EleFunAnimatedWallpaper | Valentines Day.exe | Valentines Day animated wallpaper from |
| U | EleFunAnimatedWallpaper | Water Lily.exe | Water Lily animated wallpaper from |
| X | Element | Element.txt | Added by the ELEM TROJAN! |
| X | element furth | [path] repcale.exe [path] palsp.exe | Added by a variant of the RANDON.AN WORM! Both files are often located in %System%\vert |
| U | eLert | eLert.exe | eLert Emergency Notification System by Kennected Software - "is an internet based public notification system designed to get emergency and non-emergency information out to the public quickly, efficiently and securely" |
| X | elitemedia | elitemediapop.exe | Added by the LOWZONE-BB TROJAN! Also known as Elitebar/EliteToolbar/EliteSidebar adware |
| X | EliteProtector | EliteProtector.exe | EliteProtector rogue spyware remover - not recommended, removal instructions here |
| ? | ElkCtrl | ElkCtrl.exe | Entry added when you install versions of the Logitech QuickCam webcam software. It's exact purpose is unknown at the present time |
| N | elm | Elmenv.exe | ViaTech eLicense for securing, distributing and selling music online |
| X | ELNKProxy | smproxy.exe | Surfmonkey adware |
| U | ELSA WINman Suite | Winmsuit.exe | Allows you to totally customize your ELSA graphics card settings, including overclocking the GPU |
| Y | ElsaCapiCtl | Rcapi.exe | Assumed to stand for Remote Common Application Programming Interface (RCAPI), this was installed with an Elsa Microlink ISDN modem. If it is not there you can not bring up the dialog box which is sometimes needed to reset the modem |
| U | ELSAChipGuard | elsavect.exe | ChipGuard for ELSA graphics cards - monitoring solution which monitors both the GPU temperature and fan speed, and will halt the system if either are at dangerous levels and restore the default clock speeds upon reboot. Leave enabled if overclocking |
| U | ELSBLaunch | ELSBLaunch.exe | EarthLink SpamBlocker |
| U | EM_EXEC | EM_EXEC.EXE | Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as "SmartMove". If you disable it and find you don't need it leave it disabled |
| N | EMA.exe | EMA.EXE | Time management system which helps you to manage your time and appointments |
| U | eMachines eBoard | Eboard.exe | eMachines multimedia keyboard manager. Required if you use the extra keys |
| Y | Email Protection | emlproxy.exe | Part of older versions of the range of internet security products from Quick Heal - including Total Security, Internet Security and AntiVirus. Scans incoming and outgoing E-mails for viruses and other malware in conjunction with the associated service (EMLPROXY.EXE). Also included by vendors who use the Quick Heal engine such as Omniquad |
| Y | Email Protection | EMLPROUI.EXE | Part of older versions of the range of internet security products from Quick Heal - including Total Security, Internet Security and AntiVirus. Scans incoming and outgoing E-mails for viruses and other malware in conjunction with the associated service (EMLPROXY.EXE). Also included by vendors who use the Quick Heal engine such as Omniquad and iQon |
| U | eMailEncryption | VELOZSYS.EXE | eAcceleration Stop-Sign security software related - previously not recommended (see here). It has now been delisted, so make sure you have the latest version - hence the "U" recommendation |
| U | EmailObserver | emos.exe | EmailObserver surveillance software. Uninstall this software unless you put it there yourself |
| Y | EmailScan | mcvsescn.exe | Related to McAfee AntiVirus suite - used to automatically scan incoming e-mails |
| X | eMakeSV | EMAKESV.EXE | "Switch" adult content dialer |
| X | eMakeSV | EMAKE2B.EXE | "Switch" adult content dialer |
| U | EMBASSY Trust Suite Secure Update | AutoUpdate.exe | Updates for Wave Systems Corp. Embassy Trust Suite - "delivers advanced levels of security to the client PC using the TPM security chip found on most enterprise PCs today" |
| X | eMCryT Sh3ars Panagers | [path to worm] | Added by the RBOT-AWI WORM! |
| X | eMessenger | emsn.exe | Added by the RBOT.AHO BACKDOOR! |
| Y | EMLPROUI | EMLPROUI.EXE | Part of older versions of the range of internet security products from Quick Heal - including Total Security, Internet Security and AntiVirus. Scans incoming and outgoing E-mails for viruses and other malware in conjunction with the associated service (EMLPROXY.EXE). Also included by vendors who use the Quick Heal engine such as Omniquad and iQon |
| U | EMMeter | EMMeter.exe | "Express Meter lets you track and manage software usage so you can avoid purchasing and supporting applications that aren't being used, and prevent the use of unauthorized programs" |
| X | emoc0re | emo.exe | Added by the AGOBOT-AGE WORM! |
| U | Emouse | Emouse.exe | Genius mouse driver - required if you use non-standard Windows driver features |
| U | emoze | emoze.exe | emoze pcConnector - "Push your personal & business emails, contacts & calendar directly to your mobile device!" |
| X | empin | e121307.exe | Delfin Media Viewer adware related |
| X | empin | e121307.Stub.exe | Delfin Media Viewer adware related |
| ? | Empowering Technology Launcher | eAPLauncher.exe | Part of Acer Empowering Technology. What does it do and is it required? |
| ? | EmpoweringTechnology | Framework.Launcher.exe | Part of Acer Empowering Technology. What does it do and is it required? |
| X | emre1 | emre1.exe | Added by a variant of the IRCBOT BACKDOOR! See here |
| Y | Emsisoft Anti-Malware | a2guard.exe | System Tray access to and Anti-Malware Guard feature of Emsisoft Anti-Malware from Emsi Software GmbH - which provides "comprehensive PC protection against viruses, trojans, spyware, adware, worms, bots, keyloggers and rootkits". Previously known as "a-squared Antitrojan" and "a-squared Anti-Malware" |
| X | emsw.exe | emsw.exe | Attune HelpExpress - spyware. Disable and uninstall - see here |
| X | emule | emule.exe | Added by the RBOT-ALZ WORM! Note - do not confuse with the legitimate eMule peer-to-peer (P2P) file-sharing program which is normally located in %ProgramFiles%\eMule. This one is located in %System% |
| N | eMule | emule.exe | eMule - "one of the biggest and most reliable peer-to-peer file sharing clients around the world. Thanks to it's open source policy many developers are able to contribute to the project, making the network more efficient with each release". As eMule is a is a peer-to-peer (P2P) file-sharing client used to distribute large amounts of data between multiple users make sure you have good, up-to-date virus protection and check any downloads |
| N | eMuleAutoStart | emule.exe | eMule - "one of the biggest and most reliable peer-to-peer file sharing clients around the world. Thanks to it's open source policy many developers are able to contribute to the project, making the network more efficient with each release". As eMule is a is a peer-to-peer (P2P) file-sharing client used to distribute large amounts of data between multiple users make sure you have good, up-to-date virus protection and check any downloads |
| N | eMusicClient Systray | eMusicClient.exe | eMusic MP3 download software |
| N | EN4060C Taskbar | en4060ct.exe | Comes with Efficient Networks DSL Modems. Little red/green/yellow flashing icon in system tray |
| X | enBrowser | [path to file] | WinBo adware |
| ? | encapsulated command tool | wintr.com | ?? |
| N | Encarta Dictionary Quickshelf | QSHLFED.EXE | Provides quick access to Encarta's Dictionary features? |
| N | ENCMONITOR | monitor.exe | The Encompass Monitor. This program is the Connect Direct Program. It is more trouble than it is worth and few use it |
| N | Encoder Agent | WMENCAGT.EXE | MS Windows Media Encoder, which already has a shortcut in the Start Menu if installed |
| U | Encompass_ENCMONTR | ENCMONTR.EXE | Optional simple browser from Yahoo (Encompass) |
| ? | ENCSurf | surfboard.exe | ?? |
| N | Energizer FileSaver | Energizer FileSaver.exe | Energizer FileSaver - UPS back-up utility for Energizer UPS products. From their Tech Support staff this is known to have a memory leak since it's release - with no fix planned! It will grab 2-5 handles per second and crash the average system in less than 3 days - therefore not recommended |
| U | Energy Management | Energy Management.exe | Power management software pre-installed on some Lenovo laptops |
| U | EnergyCut | EnergyCut.exe | Power management software pre-installed on some Lenovo laptops |
| U | EnergyCut_Utility | utilty.exe | Power management software pre-installed on some Lenovo laptops |
| X | EnergyPlugIn | EnergyPlugin.exe | EnergyPlugin adware variant |
| U | EnergyUtility | utility.exe | Power management software pre-installed on some Lenovo laptops |
| U | enginecs2 | enginecs2.exe | Cyber Sentinel - internet filtering software |
| Y | EngUtil | EngUtil.exe | Part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools - corrects any modification made to the Roxio Engine, it exits after checking |
| X | Enh Win Updt | enhupdt.exe | Adware - detected by Kaspersky as the ONECLICKNETSEARCH.H TROJAN! |
| X | enhance32 | enhance32.exe | Added by the CRYPTER.A TROJAN! |
| X | Enigma | eNigma_Kutim.exe | Added by the AUTORUN-BS WORM! |
| N | EnigmaPopupStop | EnigmaPopupStop.exe | Part of Enigma SpyHunter - not recommended, see here |
| ? | ENSApServer2_0 | APSERVER.EXE | Intel AnyPoint Wireless II Home Network related. Now discontinued. What does it do and is it required? |
| ? | ENSMIX32.EXE | ENSMIX32.EXE | Sound card driver. Is it required? |
| U | EnsoniqMixer | starter.exe | Puts the Ensoniq mixer in system tray. From Ensoniq Technologies "Our mixer is a critical part of the soundcard as it fixes sound problems and replaces the MS mixer which can no longer be used". If you find you don't need it - try one of the solutions on this special page. Similar to Creative PCI Audio Configuration Utility |
| U | Entbloess 2 | Entbloess2.exe | Related to Window-Switcher (now Reflex Vision) - it allows you to see previews of all your open applications via a single keystroke in a manner similar to Apple's Exposé, for Windows 2K/XP |
| U | Enterprise Harmony | rsMenu.exe | Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000 |
| U | Enterprise Harmony '99 | rsMenu.exe | Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000 |
| X | Enterprise Suite | WE[random characters].exe | Enterprise Suite rogue security software - not recommended, removal instructions here |
| U | Enterra Icon Keeper | IcnKeepr.exe | Icon Keeper - "tool to save and restore icon positions on the desktop" |
| X | EntraOcio | rundll32.exe MSA64CHK.dll,DllMostrar | MatrixDialer/Mostrar parasite. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in %System% |
| X | Enumerate Service | wsys.exe | Added by the MANIFEST TROJAN! |